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Dated: 14 March 2022 
Subject: Update of the GVL registration : addition of new fields 
Dear All, 


This communication gives you formal notification of changes to the TCF registration and TCF 
Technical Specifications to expand the information required from Vendors when registering 
on the Global Vendor List (GVL). This additional information is not intended for user disclosures 
but can be used by Publishers for determining which Vendors they wish to establish 
transparency and consent for on their digital properties. This additional information will not 
appear in the GVL JSON file here. It will be made available in a separate JSON file that is listed 
in the updated TCF Technical Specification here. 


Adding these new fields to the Vendor registration has been approved by the TCF working 
groups (WG) including the Policies WG, Framework Signals WG and the Steering Group and 
does not require an amendment to the TCF policy. 


The new fields cover the following detail: 


e Full legal entity address ; 

e Business-to-business contact details ; 

e Territorial scope - the EU/EEA/EFTA/UK jurisdictions where the vendor operates in the 
context of its TCF registration. Note that this is different from the place of 
establishment ; 

e Environment — environment(s) where the vendor operates such as web, mobile apps, 
CTV apps ; 

e Type of service — Vendor's type of service(s) such as SSP, DSP, DMP ; 

e International transfer — indication if the vendor transfers data outside EU/EEA ; 

o when applicable, indication if the data transfers are covered by an EU adequacy 
decision. 


Registration field deviceStorageDisclosureUrl 


Alongside the introduction of this additional Vendor information, the TCF Steering Group has 
also approved an update to the optional registration field deviceStorageDisclosureUrl. 


The TCF registration process will now require Vendors to provide a secure URL to a JSON 
resource containing the following information: 


1. Disclosures related to purpose-specific storage and access information, specifically 
Vendors MUST publish granular disclosures for web-based storage - ‘cookie’ and ‘web’ 
mechanism types. Vendors may provide ‘app’ storage type disclosures, but are not 
required to do SO. 
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2. The web domains Vendors use for collecting and processing personal data in the 
context of your TCF registration. Vendors MUST NOT include Publishers’ delegated 
domains or subdomains they may use. 


The JSON resource must conform to the content and structure specified in the TCF Technical 
Specifications here. 


The registration field name will remain the same and continue to be disclosed in the GVL here. 
CMPs may disclose portions of this information to data subjects in Framework Uls, and TCF 
participants can process such information to support their internal compliance procedures. 


Listing of Vendor domain names will also assist publishers in understanding which Vendors 
are active on their properties and assist IAB Europe with the Vendor compliance programme. 


Next Steps 


Vendors must apply the necessary changes to their registration by 14th July 2022. A reminder 
will be sent 1 month prior to this deadline. Please note that the JSON resource of the 
deviceStorageDisclosureUrl will be verified to ensure compliance with the content and structure 
specified in the TCF Technical Specifications before being added to the GVL. 
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